Somehow, such dishonesty is tolerated for corporations. That will eventually bite the people back.

Security is personal. Very few people in companies don't violate exposing their user sessions to others unattended, which is a security breach. With GDPR, such lax security may carry million dollar fines, and prison time.